Research

You want it and you want it now. So do I. Whatever it is. We live in an age of instant gratification. You don’t need to wait for the mailman to deliver letters – you get them via email. If you can’t wait the 2 days for Amazon Prime shipping, you order it online and pick it up at one of the few remaining brick and mortar stores. Record stores? Ha! Book stores? Double ha!! We live in the download age. You want it, you buy it (or not), and you download it. You have it within seconds. But what happens when you don’t get what you want or (egads!) when you have to wait? You are disappointed. We all are. We get locked into that thing. It’s the only outcome we can see. Maybe it’s a thing, maybe it’s an activity. Maybe it’s a reaction from someone, or more money, or a promotion. It could be anything, but you want it and you get pissy when you don’t get it – now! The problem comes down to attachment. Disappointment happens when you don’t get the desired outcome in the timeframe you want. Disappointment leads to unhappiness, which leads to sickness, and so it goes. I have made a concerted effort to stop attaching myself to specific outcomes. Sure, there are goals I have and things I want to achieve. But I no longer give myself a hard time when I don’t attain them. I don’t consider myself a failure when things don’t go exactly as I plan. At least I try not to… But I was struggling to find an analogy to rely on for this philosophy, until earlier this week. I was in a discussion in a private Facebook group, and I figured out the concept in a way I can easily remember and rely on when my mind starts running amok. I think many of us fall into the trap of seeing a desirable outcome and getting attached to that. I know I do. I’m trying to flow like water. Water doesn’t care where it ends up. It goes along the path the provides the least resistance at any given time. Not that we don’t need resistance from time to time to grow, rather we need to be flexible to adapt to the reality of the moment. Be like water. Water takes the shape of whatever vessel it’s in. Water flows. Water has no predetermined goal and can change form as needed. As the waves crash they show the awesome power of harnessed water. The analogy also works for me because I like being by the water, and the sound of water calms me. But I am not the only one who likes the water. Bruce Lee figured this out way before me and talked about it in this classic interview. Maybe the concept works for you, and maybe it doesn’t. It’s fine either way for me – I’m not attached to a particular outcome… –Mike Photo credit: “The soothing sound of flowing water” originally uploaded by Ib Aarmo The fine folks at the RSA Conference posted the talk Jennifer Minella and I did on mindfulness at the conference this year. You can check it out on YouTube. Take an hour and check it out. Your emails, alerts and Twitter timeline will be there when you get back. Securosis Firestarter Have you checked out our new video podcast? Rich, Adrian, and Mike get into a Google Hangout and.. hang out. We talk a bit about security as well. We try to keep these to 15 minutes or less, and usually fail. October 27 – It’s All in the Cloud October 6 – Hulk Bash September 16 – Apple Pay August 18 – You Can’t Handle the Gartner July 22 – Hacker Summer Camp July 14 – China and Career Advancement June 30 – G Who Shall Not Be Named June 17 – Apple and Privacy May 19 – Wanted Posters and SleepyCon May 12 – Another 3 for 5: McAfee/OSVDB, XP Not Dead, CEO head rolling Heavy Research We are back at work on a variety of blog series, so here is a list of the research currently underway. Remember you can get our Heavy Feed via RSS, with our content in all its unabridged glory. And you can get all our research papers too. Monitoring the Hybrid Cloud: Evolving to the CloudSOC Introduction Building an Enterprise Application Security Program Introduction Use Cases Security and Privacy on the Encrypted Network The Future is Encrypted Secure Agile Development Deployment Pipelines and DevOps Building a Security Tool Chain Process Adjustments Working with Development Agile and Agile Trends Introduction Newly Published Papers Trends in Data Centric Security Leveraging Threat Intelligence in Incident Response/Management The Security Pro’s Guide to Cloud File Storage and Collaboration The 2015 Endpoint and Mobile Security Buyer’s Guide Open Source Development and Application Security Analysis Advanced Endpoint and Server Protection Defending Against Network-based DDoS Attacks The Future of Security Incite 4 U Shiny attack maps for everyone: I hand it to Bob Rudis and Alex Pinto for lampooning vendors’ attack maps. They have issued an open source attack map called IPew, which allows you to build your own shiny map to impress your friends and family. As they describe it, ‘IPew is an open source “live attack map” simulation built with D3 (Datamaps) that puts global cyberwar just a URL or git clone away for anyone wanting to display these good-for-only-eye-candy maps on your site.’ Humor aside, visualization is a key skill, and playing around with their tool may provide ideas for how you can present data in a more compelling way within your own shop. So it’s not all fun and games, but if you do need some time to decompress, set IPew to show the Internet having a bad day… War Games FTW. – MR Not for what you think: Occasionally we need to call BS on a post, and Antone Gonsalves on Fraudster Protection

As we wrote in The Future of Security, we believe the collision of cloud computing and mobility will disrupt and transform security. We started documenting the initial stages of the transformation, so we now turn our attention to how controls will be implemented as the technology space moves to an automated and abstracted reality. That may sound like science fiction, but these technologies are here now, and it is only beginning to become apparent how automation and abstraction will ripple outward, transforming the technology environment. Change is hard, and we face a distinct lack of control over a number of areas, which is enough to give most security folks a panic attack. From an access standpoint IT can no longer assume ownership and/or the ability to control devices. Consumption occurs on user-owned devices, everywhere, and often not through corporate-controlled networks. This truly democratizes access to critical information. IT organizations must accept no longer controlling the infrastructure either. In fact they don’t even know how the underlying systems are constructed – servers and networks are virtual. Compute, storage, and networking now reside outside the direct control of staff. You cannot just walk down to the data center to figure out what’s going on. As these two megatrends collide, security folks are caught in the middle. The ways we used to monitor devices and infrastructure no longer work. Not to the same degree, anyway. There are no tap points, and it is now prohibitively inefficient to route traffic through central choke points for inspection. Security monitoring needs to change fundamentally to stay relevant in the cloud age. Our new blog series, Monitoring the Hybrid Cloud: Evolving to the CloudSOC, we will dig into the new use cases you will need to factor into your security monitoring strategy, and discuss the emerging technologies that can help you cope. Finally we will discuss migration, because you will be dealing with legacy infrastructure for years to come, so your environment will truly be a hybrid. The Cloud Is Different For context on this disruptive innovation we borrow from our Future of Security paper to describe how and why the cloud is different. And just in case you think these changes don’t apply to you, forget it. Every major enterprise we talk with today uses cloud services. Even some of the most sensitive and highly regulated industries, including financial services, are exploring more extensive use of public cloud computing. We see no technical, economic, or even regulatory issues seriously slowing this shift. The financial and operational advantages are simply too strong. Defining ‘Cloud’: Cloud computing is a radically different technology model – it is not simply the latest flavor of outsourcing. The cloud uses a combination of abstraction and automation to achieve previously impossible levels of efficiency and elasticity. This, in turn, creates new business models and alters the economics of technology delivery and consumption. Cloud computing fundamentally disrupts traditional infrastructure because it is more responsive, more efficient, and potentially more resilient and cost effective than the status quo. Public cloud computing is even more disruptive because it enables organizations to consume only what they need without overhead, while still rapidly adapting to changing needs at effectively infinite scale. Losing Physical Control: Many of today’s security controls rely on knowing and managing the physical resources that underpin our technology services. This is especially true for security monitoring, but let’s not put the cart before the horse. The cloud breaks this model by virtualizing resources (including entire applications) into resource pools managed over the network. We give up physical control to standard network interfaces, effectively creating a new management plane. The good news is that centralized control is built into the model. The bad news is this is likely to destroy the traditional security controls you rely on. At minimum most of your existing operational processes will change fundamentally. A New Emphasis on Automation: The cloud enables extreme agility, such as servers that exist only for minutes – automatically provisioned, configured, and destroyed without human interaction. Entire data centers can be spun up and operational with just a few lines of code. Scripts can automate what used to take IT staff weeks to set up physically. Application developers can check in a piece of code, which then runs through a dozen automated checks and is pushed into production on a self-configuring platform that scales to meet demand. Security can leverage these same advantages, but the old bottlenecks and fixed inspection points – including mandated human checks – are gone because a) they cannot keep up and b) architecting them in would slow everthing else down. The cloud’s elasticity and agility also enable new operational models such as DevOps, which blurs the lines between development and operations, to consolidate historically segregated management functions, in orer to improve efficiency and responsiveness. Developers take a stronger role in managing their own infrastructure through heavy use of programming and automation through easily accessible APIs. DevOps is incredibly agile and powerful, but it contains the seeds of possible disaster for both security and availability, because DevOps condenses and eliminates many application development and operations check points. Legacy Problems Fade: Some security issues which have plagued practitioners for decades are no longer issues in the cloud. The dynamic nature of cloud servers can reduce the need for traditional patching – you can launch a new fully up-to-date server and shift live traffic to and from it with API calls. Network segmentation becomes the default, as all new instances are in fixed security groups. Centralizing resources improves our ability to audit and control, while still offering ubiquitous access. Monitoring Needs to Change The entire concept of monitoring depends on seeing things. We need the ability to pull logs and events from the network and security devices protecting your environment. What happens when you don’t have access to those devices? Or they don’t work like the devices you are familiar with in your traditional data center? You need to reconsider your approach to security monitoring.

Sometimes a short memory is very helpful. Of course as you get older, it may not be a choice. But old guy issues aside, there are times you need to forget what just happened and move on to the next thing. Maybe it’s a deal you lost, or a project you couldn’t get funded, or a bungled response to an incident. If you live to fight another day then you need to learn, put it in the past, and move forward. The Boy learned that lesson a few weeks back playing tennis. He’s a decent player and was teamed with his friend in a doubles match. The other kids were pretty good but our team sprinted out to a 7-2 lead. The first to 8 wins. He has it in the bag, right? They dropped the next game, so it was 7-3. Not a problem. Then it was 7-5 and the Boy started to panic. I could see it. He was on the verge of breaking down. And the thing about tennis is that coaches (and parents) cannot get involved during the match. So besides a few hand signals I sent his way to calm down, there wasn’t anything I could do other than see him come apart at the seams. His partner was panicking as well, especially as the score went to 7-6, and then ultimately 7-7. You could see the Boy and his partner were broken. They dropped 5 games in a row and lost their confidence. It was hard to watch. Really hard. For a guy used to controlling most of his environment, it was brutal to be so powerless. But this wasn’t about me. It’s about him. The Boy served in that next game and held serve. He hit a couple of winners and got his mojo back. You could see the confidence return. They dropped the next game and went into a tiebreaker. The first to 7 would win the match. They split the first two points on the opponents’ serve, so that was a mini break. The Boy then held their serve, so it was 3-1. Then they broke again. 5-1. The other team scrapped and they had a few good rallies, but the Boy and his partner prevailed 7-3. He was happy but could only shake his head about blowing such a huge lead. I pulled him aside and said this illustrates a number of very important lessons. First about fighting through. They didn’t give up, and they persevered to get the win. I was very proud of them for that. But the real lesson I wanted to communicate was the importance of having a short memory. The fact that he hit a bad shot doesn’t mean he’s a bad player. He needs to trust his training and the work he put in. He can’t lose confidence, and needs to just move on to the next thing. It is not productive to get lost in his own head – he needs to understand the battle is less important than the war, and to know the difference. Of course the lesson wasn’t about tennis. It was about life. But I don’t need to tell him that. Not yet, anyway… –Mike Photo credit: “The Bryan Brothers” originally uploaded by Boss Tweed The fine folks at the RSA Conference posted the talk Jennifer Minella and I did on mindfulness at the conference this year. You can check it out on YouTube. Take an hour and check it out. Your emails, alerts and Twitter timeline will be there when you get back. Securosis Firestarter Have you checked out our new video podcast? Rich, Adrian, and Mike get into a Google Hangout and.. hang out. We talk a bit about security as well. We try to keep these to 15 minutes or less, and usually fail. October 27 – It’s All in the Cloud October 6 – Hulk Bash September 16 – Apple Pay August 18 – You Can’t Handle the Gartner July 22 – Hacker Summer Camp July 14 – China and Career Advancement June 30 – G Who Shall Not Be Named June 17 – Apple and Privacy May 19 – Wanted Posters and SleepyCon May 12 – Another 3 for 5: McAfee/OSVDB, XP Not Dead, CEO head rolling Heavy Research We are back at work on a variety of blog series, so here is a list of the research currently underway. Remember you can get our Heavy Feed via RSS, with our content in all its unabridged glory. And you can get all our research papers too. Building an Enterprise Application Security Program Introduction Security and Privacy on the Encrypted Network The Future is Encrypted Secure Agile Development Deployment Pipelines and DevOps Building a Security Tool Chain Process Adjustments Working with Development Agile and Agile Trends Introduction Newly Published Papers Trends in Data Centric Security The Security Pro’s Guide to Cloud File Storage and Collaboration The 2015 Endpoint and Mobile Security Buyer’s Guide Open Source Development and Application Security Analysis Advanced Endpoint and Server Protection Defending Against Network-based DDoS Attacks Reducing Attack Surface with Application Control Leveraging Threat Intelligence in Security Monitoring The Future of Security Incite 4 U Card of the Sith: Thanks to Chris Pepper for pointing out CurrentC Is The Big Retailers’ Clunky Attempt To Kill Apple Pay And Credit Card Fees. In a nutshell, a large group of merchants – including Rite Aid, CVS, Walmart, Target, K-Mart, and Kohl’s – are putting together a “mobile payment” app to avoid paying credit card processing fees. Rather than extend a small loan like a credit card, CurrentC will pull money directly and immediately from your bank account. Yes, those very same firms who vigorously market your personal data – and keep getting breached by hackers – now want to build their own payment system and on top of direct access to your bank account. What could possibly go wrong? The biggest issue is one of the very real benefits of credit cards: limited

Lots of folks talk lovingly about their first computers. Mine was a Timex Sinclair I ran through my 10” black-and-white TV. But that wasn’t the first computer I played with. My Dad was pretty early into the word processing world as part of his law practice. So when we went to the computer show down in NYC and checked out all the new wares, I was like a kid in a candy store. When he lugged home the Kaypro II, I thought it was the coolest thing ever. And evidently a significant productivity enhancer, especially hooked up to that old daisy wheel printer. You remember those, right? So when I saw Throwback Thursday: Kaypro II Stole My Heart on InformationWeek, it was a nostalgic moment. The Kaypro II, released in 1982, featured two 5¼-inch double-density floppy-disk drives, 64 KB of RAM, and ran Digital Research’s CP/M operating system. Weighing in at 29 pounds, it and other PCs like it were dubbed transportables or, more cheekily, luggables. Luggable LOL. Though I do remember my Dad lugging the Kaypro between his condo and the office, so I guess it was transportable. And mention of the 9” green (monochrome) CRT made me smile as well. Of course my kids will have no grasp of what the early days of personal computing were really like. They are bitching about their old iPod touches that won’t run iOS 8. And they are right – technology is moving so fast that a 5-year-old device is severely limited. But old folks (or at least survivors of that early computer age) like me remember. And we laugh. Because the progress we have seen over the past 30 years is really incredible. Yet it’s only beginning. I cannot even imagine what things will look like in another 30 years. Photo credit: “untitled” originally uploaded by Marcin Wichary Share:

There were always reasons I wasn’t a runner. I was too big and carried too much weight. I was prone to knee pain. I never had good endurance. I remember the struggle when I had to run 3 miles as a pledge back in college. I finished, but I was probably 10 minutes behind everyone else. Running just wasn’t for me. So I focused on other methods of exercise. I lifted weights until my joints let me know that wasn’t a very good idea. Then I spent a couple years doing too many 12-ounce curls and eating too many burritos. For the past few years I have been doing yoga and some other body weight training. But it was getting stale. I needed to shake things up a bit. So I figured I’d try running. I had no idea how it would go, given all my preconceived expectations that I couldn’t be a runner. I mentioned it to a friend and he suggested I start with a run/walk program espoused by Jeff Galloway. I got his 5K app and figured I’d work up to that distance over the summer. I started slowly during my beach vacation. Run 2 minutes, walk 1 minute. Then I ran 3 minutes, etc. Before I knew it, I had worked up to 3 miles. At some point my feet started hurting. I knew it was time to jettison my 5-year-old running shoes and get a real pair. I actually went to the running store with the boy and got fitted for shoes. It made a world of difference. I was running 3 days a week and doing yoga another 3 days. I was digging it. Though over the summer it wasn’t that hard. I’d get out early before it got too hot and just run. After conquering the 5K I figured I’d work up to a 10K, so I started another training program to build up to that distance. I made it to the 6-mile mark without a lot of fuss. Even better, I found myself in cool places for work and I’d run there. It’s pretty okay to start the day with a run along Boulder Creek or the Embarcadero. Life could be worse. I was routinely blowing past the suggested distance in the 10K program. I banged out almost 7 miles on one run and wasn’t totally spent. That’s when it hit me. Holy crap, I’m a runner. So I decided to run a half marathon in March. I figured that was plenty of time to get ready and a couple buddies committed to run with me. I did 8 miles and then 10 miles. Just to see if I could, and I could. Then I thought, what the hell am I waiting for? My sister-in-law is running a half in early November and she is just working up to 10 miles. I signed up to run a half this Thanksgiving. I even paid $15 for the race t-shirt (it’s a free race, so the shirt was extra). That’s in about a month and I’ll be ready. If there is one thing I have learned from this, it’s that who I was doesn’t dictate what I can accomplish. I can overcome my own perceptions and do lots of things I didn’t think I could, including running. –Mike Photo credit: “Day 89 – After the Run” originally uploaded by slgckgc The fine folks at the RSA Conference posted the talk Jennifer Minella and I did on mindfulness at the conference this year. You can check it out on YouTube. Take an hour and check it out. Your emails, alerts and Twitter timeline will be there when you get back. Securosis Firestarter Have you checked out our new video podcast? Rich, Adrian, and Mike get into a Google Hangout and.. hang out. We talk a bit about security as well. We try to keep these to 15 minutes or less, and usually fail. October 6 – Hulk Bash September 16 – Apple Pay August 18 – You Can’t Handle the Gartner July 22 – Hacker Summer Camp July 14 – China and Career Advancement June 30 – G Who Shall Not Be Named June 17 – Apple and Privacy May 19 – Wanted Posters and SleepyCon May 12 – Another 3 for 5: McAfee/OSVDB, XP Not Dead, CEO head rolling May 5 – There Is No SecDevOps Heavy Research We are back at work on a variety of blog series, so here is a list of the research currently underway. Remember you can get our Heavy Feed via RSS, with our content in all its unabridged glory. And you can get all our research papers too. Security and Privacy on the Encrypted Network The Future is Encrypted Secure Agile Development Deployment Pipelines and DevOps Building a Security Tool Chain Process Adjustments Working with Development Agile and Agile Trends Introduction Trends in Data Centric Security Deployment Models Tools Introduction Use Cases Newly Published Papers The Security Pro’s Guide to Cloud File Storage and Collaboration The 2015 Endpoint and Mobile Security Buyer’s Guide Open Source Development and Application Security Analysis Advanced Endpoint and Server Protection Defending Against Network-based DDoS Attacks Reducing Attack Surface with Application Control Leveraging Threat Intelligence in Security Monitoring The Future of Security Incite 4 U Attitude > technical chops: It seems every day someone bitches to me about the difficulty in finding good people to staff the security function. Thom Langford thinks a lot of folks are looking in the wrong places, and that good potential security folks may already be in your organization – just not doing security. Thom added an executive assistant to the security team and it has worked out well for him because of her attitude and understanding of how to get things done within the organization. “Technology and hard skills are things that can be taught in relatively short periods of time; attitude is something that takes a lot longer to learn, decades even.” Actually, a lot of

It won’t happen to you, right? After every breach you see all sorts of former employees and others crawl out from under their various rocks to talk about how screwed-up their former employer was. And how the breach was inevitable. It is a bit comical at this point. The latest example is a bunch of former Home Depot employees talking about their old shop. Yet five former staffers describe a work environment in which employee turnover, outdated software, and a stated preference for “C-level security” (as opposed to A-level or B-level) hampered the team’s effectiveness. Well, here is BREAKING news. Every big company is screwed up in some way. Every company – big or small – needs to make tough choices. Some companies consistently choose wrong. Others do a good job of making those decisions – or they get lucky, it doesn’t really matter. But the truth remains: they will all get breached… sooner or later. In the aftermath of a breach – or really any mistake – there are always things that could have been done differently. But most security folks need to toe the corporate line, which may be to deal with mediocre security. Job #1 is often not to disrupt business operations. As a security person such directives may make you sick. And if your shop consistently makes decisions like this, maybe you should work somewhere else. That’s always a choice. And sooner or later (likely sooner), you will get called by journalists looking for dirt. Then you can say you told them so and they didn’t listen. Good for you. Photo credit: “Black and white hindsight” originally uploaded by Tim J Keegan Share:

This is off topic, but this post from Daniel Miessler is a great example of how I want to reorient my world view. Basically, I’ve done most things I could have wanted to do in a life already. This doesn’t mean that I don’t have more to do. It doesn’t mean I don’t still have goals, because I do. What it means is that if things were to end suddenly tomorrow, and I had even the shortest time to reflect, I would smile knowing that there wasn’t some other big thing I needed to be happy. I already am happy. Anything past this point is just greedy. I’ve already lived a remarkable life, and now I want another 50 years of it? Seems rather selfish when you think about it. That is real gratitude. From where I sit, I still feel I have a lot to contribute and so much more to learn. And I’m not one to call my life to date ‘remarkable’, but I have done some cool stuff. I’m with Daniel – I don’t want to be greedy. This kind of gratitude is hard for a lot of us, as culture has us striving to move on to the next hill – before we are over the current one. In the rush to always get something else done, I find it helpful to sometimes just sit and appreciate where I have already been. That helps me get excited for whatever is to come. Both the positives and the negatives. Everything is a learning experience. Today I’m grateful for the opportunity to keep learning. Photo credit: “Gratitude changes the way we look at the world” originally uploaded by BK Share:

A few years ago I had to stop competing. The constant need to win – whatever that even meant – was making me unhappy. Even when things were going well, I found some reason to feel like a loser. So I got off the hamster wheel and put myself in positions where I wasn’t really competing against others. I am always trying to improve, but I stopped doing that in terms of others. Set a goal. Work toward it. Adjust as needed. The only time I even sort of compete now is my annual golf trip. Except for four rounds that weekend, I don’t play golf. It’s not that I don’t enjoy the game, but it just takes too much time. So every year 9-11 buddies and I go to a nice resort town and play a tournament Ryder Cup style. There is a draft and this year we used Potato Head dolls to represent the players. Mine was a riot, as you can see in the picture below. The captains negotiate handicaps and set the line-ups, and we play. The winners make some beer money and the losers… well, there aren’t actually any losers – we are hanging with buddies on a ridiculous beachfront property and playing golf every day. Since I’m not a good golfer, I am usually the high handicapper. But it’s not like that helps me much. At multiple points over four days, my game falls apart. I typically shoot between 120 and 130, usually losing the match. Except there are no losers, right? But this year was different. I missed last year’s trip so I hadn’t picked up my clubs in 2 years. I went to the new TopGolf near my house the day before the trip to hit some balls, and I was hitting solid and straight. But I entered the weekend with zero expectations about playing decent golf. Without those expectations I was calm on the course. I just enjoyed being outside in a beautiful place. I had a few beers. OK, maybe more than a few. I kept my ego in the bag and swung nice and easy – even as some of the gorillas in my group hit 50-60 yards past me. I shot pretty well the first day (111) and with my handicap we smoked the other team. Huh. The next day I was playing a heads-up match. I shot a 101 and closed out my opponent on the 13th hole, which is apparently pretty good. Strange. My game didn’t fall apart. What’s going on here? By this time I had a pretty sizable lead in the overall. The other guys on the trip started talking about how evidently I’m a golfer and wondering if I had secretly taken a crapload of lessons. Then I actually believed maybe I was a golfer, and I wanted to win. I started feeling bad when I hit a bad shot. Predictably my game fell apart and I shot 61 on the front. Then I remembered that I don’t need to win, I just want to be credible. That is the key. It’s about not getting attached to the outcome and just having fun instead. So that’s what I did. Suffice it to say I shot 44 on the back and had a grand old time. I finished up Sunday with a 117 and took home the overall. That means I will be one of the captains next year – a place I never thought I’d be. I lost the final day match, but my team won the cup as well. So I won by not needing to win. What was the difference? Without sounding corny, it’s all the mindfulness work I’m doing. I used body awareness and scanned my body for tension points before every swing to make sure I was relaxed. I visualized a good shot, not skulling the ball into the water hazard. I recognized that my increasing desire to win was causing tension, which resulted in bad shots. I had a short memory, so when I hit a bad shot I’d just let it go. Then I’d hit a good shot. Or not. I’d look up at the sky and be grateful that I was on the course. Then drink another beer. At some point during the trip I made the connection. Golf is mostly a mental game, as is most of life. The work I’m doing to be more mindful translates directly – even to my golf trip. Controlling my own self-imposed expectations and decreasing the pressure I put on myself allowed me to compete without stressing out. Being able to maintain that for four days was a real victory. Winning the golf trophy is besides the point. At least for me… –Mike Photo credit: Incite Potato Head uploaded by MSR The fine folks at the RSA Conference posted the talk Jennifer Minella and I did on mindfulness at the conference this year. You can check it out on YouTube. Take an hour and check it out. Your emails, alerts and Twitter timeline will be there when you get back. Securosis Firestarter Have you checked out our new video podcast? Rich, Adrian, and Mike get into a Google Hangout and.. hang out. We talk a bit about security as well. We try to keep these to 15 minutes or less, and usually fail. October 6 – Hulk Bash September 16 – Apple Pay August 18 – You Can’t Handle the Gartner July 22 – Hacker Summer Camp July 14 – China and Career Advancement June 30 – G Who Shall Not Be Named June 17 – Apple and Privacy May 19 – Wanted Posters and SleepyCon May 12 – Another 3 for 5: McAfee/OSVDB, XP Not Dead, CEO head rolling May 5 – There Is No SecDevOps Heavy Research We are back at work on a variety of blog series, so here is a list of the research currently underway. Remember you can get our Heavy Feed via RSS,

I had a bit of a surreal experience earlier this week. Rich probably alluded to it a few times on the Twitter, but we are all as busy as we have been since we started the new Securosis 5 years ago. I m traveling like a mad man and it’s getting hard to squeeze in important meetings with long-time clients. But you do what you need to – we built this business on relationships, and that means we pay attention to the ones that matter. So when a Monday meeting on the west coast is the only window you can meet with a client before an important event, you do it. I flew out Sunday and had a good meeting Monday. But there was a slight complication. I was scheduled to do the mindfulness talk with JJ at the ISC2 Congress Tuesday morning in Atlanta. I had agreed to speak months ago and it’s my favorite talk, so there was no way I was bailing on JJ. That means the red-eye. Bah! I hate the red-eye. I have friends who thrive on it. They hate the idea of spending a working day in the air. I relish it because I don’t have calls and can mute the Tweeter. I get half a day of solid thinking, writing, or relaxing time. With in-flight networking I can catch up on emails and reading if I choose. So I can be productive and compensate for my challenges sleeping on planes. If I get a crappy night’s sleep the next couple of days are hosed, and that’s not really an option right now. Thankfully I got an upgrade to first class, which is about as rare as sniffing unicorn dust. I poured my exhausted self into my first-class seat, plugged in my headphones, and slept pretty well, all things considered. It wasn’t solid sleep, but it was sleep. When we landed in ATL I felt decent. Which was a lot better than I expected. So what now? Normally I’d get in the car and drive home to get all pretty for the conference. But that wouldn’t work this week because I needed to be in another city Tuesday afternoon, ahead of another strategy day on Wednesday. I didn’t have time to go home, clean up, and then head back downtown for my talk. I made some calls to folks who would be at the ISC2 conference and was graciously offered the use of a shower. But that would involve wading into some man soup in a flop room, so I was grateful for the offer, but kept looking for alternatives. Then I realized the ATL airport has showers in some of its Sky Clubs. So I trudged down to the International Terminal and found a very spacious, comfortable changing room and shower. It was bigger than some hotel rooms I’ve had in Europe. I became a stranger in my own town. Showering up at my home airport to do a talk in my city before heading back to the airport to grab another flight to another city. The boy told me it was cool to be in 3 cities in less than a day. I told him not so much, but it’s what I do. It’s a strange nomadic existence. But I’m grateful that I have clients who want to meet with me, and a family who is understanding of the fact that I love my job… –Mike Photo credit: “Darth Shower” originally uploaded by _Teb The fine folks at the RSA Conference posted the talk Jennifer Minella and I did on mindfulness at the conference this year. You can check it out on YouTube. Take an hour and check it out. Your emails, alerts and Twitter timeline will be there when you get back. Securosis Firestarter Have you checked out our new video podcast? Rich, Adrian, and Mike get into a Google Hangout and.. hang out. We talk a bit about security as well. We try to keep these to 15 minutes or less, and usually fail. September 16 – Apple Pay August 18 – You Can’t Handle the Gartner July 22 – Hacker Summer Camp July 14 – China and Career Advancement June 30 – G Who Shall Not Be Named June 17 – Apple and Privacy May 19 – Wanted Posters and SleepyCon May 12 – Another 3 for 5: McAfee/OSVDB, XP Not Dead, CEO head rolling May 5 – There Is No SecDevOps April 28 – The Verizon DBIR Heavy Research We are back at work on a variety of blog series, so here is a list of the research currently underway. Remember you can get our Heavy Feed via RSS, with our content in all its unabridged glory. And you can get all our research papers too. Security and Privacy on the Encrypted Network The Future is Encrypted Secure Agile Development Building a Security Tool Chain Process Adjustments Working with Development Agile and Agile Trends Introduction Trends in Data Centric Security Deployment Models Tools Introduction Use Cases Newly Published Papers The Security Pro’s Guide to Cloud File Storage and Collaboration The 2015 Endpoint and Mobile Security Buyer’s Guide Open Source Development and Application Security Analysis Advanced Endpoint and Server Protection Defending Against Network-based DDoS Attacks Reducing Attack Surface with Application Control Leveraging Threat Intelligence in Security Monitoring The Future of Security Incite 4 U Gorillas in the mist: In case you missed it, was another important vulnerability was disclosed last week, aside from Shellshock. It was a flaw with the network security library used by Firefox and Google’s Chrome that allows an attacker to create forged RSA signatures to confuse browsers. In practice someone can fake a certificate for eBay or Amazon – or any other SSL connection – and act as a man-in-the-middle, collecting any private data sent down the pipe. You’d think that we would have beaten on SSL libraries enough to uncover these types of flaws, but just as with the bash shell vulnerability we will

The cloud and mobility are disrupting how IT builds and delivers value to the organization. Whether you are moving computing workloads to the cloud with your data now on a network outside your corporate perimeter, or an increasingly large portion of your employees are now accessing data outside of your corporate network, you no longer have control over networks or devices. Security teams need to adapt their security models to protect data. For details see our recent Future of Security research. But this isn’t the only reasons organizations are being forced to adapt security postures. The often discussed yet infrequently addressed insider threat must be addressed. Given how attackers are compromising devices, performing reconnaissance to find vulnerable targets and sniffing network traffic to steal credentials, at some point during every attack the adversary becomes an insider with credentials to access your most sensitive stuff. Regardless of whether an adversary is external or internal, at some point they will be inside your network. Finally, tighter collaboration between business partners means people outside your organization need access to your systems and vice-versa. You don’t want this access to add significant risk to your environment, so those connections need to be protected somehow to ensure data is not stolen. Given these overarching trends, organizations have no choice but to encrypt more traffic on their networks. Encrypting the network prevents adversaries from sniffing traffic to steal credentials, and ensures data moving outside the organization is protected from man-in-the-middle attacks. But no good deed goes unpunished. Encrypting network traffic impacts traffic inspection and enforcement of security policies. Encrypted networks also complicate security monitoring because traffic needs to be decrypted at wire speed for capture and forensics. Encrypted traffic also presents compliance issues and raises human resources considerations around decryption, which must be factored into your plans as you contemplate driving network encryption deeper into the network. In our new series, Security and Privacy on the Encrypted Network, we will discuss how to enforce security policies to ensure data isn’t leaking out over encrypted tunnels, and employees adhere to corporate acceptable use policies, by decrypting traffic as needed. Then we will dive into the security monitoring and forensics use case to discuss traffic decryption strategies to ensure you can properly alert on security events and investigate incidents. Finally we will wrap up with guidance about how to handle human resources and compliance issues as an increasing fraction of network traffic is encrypted. We would like to thank Blue Coat Systems for potentially licensing the paper when this project is complete. Without our clients willingness to license our research you wouldn’t be able to access this research for the low low price of $0… Share: